e-commerce – Page 2 – Privacy Design®

June 28, 2020June 29, 2020

publishable_fr_2019-03_lawfulness_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No violation

Background information
Date of final decision: 22 March 2019
LSA: FR
CSAs: AT, BE, DE-Berlin, DE-Mecklenburg-Western Pomerania, DE-Bavaria (private sector), DE-Lower Saxony
Legal Reference: Right to object (Article 21), Principles relating to processing of personal data (Article 5), Lawfulness of the processing (Article 6), Conditions for consent (Article 7)

Decision: No violation
Key words: Rights of data subjects, Right to object, Lawfulness of processing, e-Commerce, Marketing

Summary of the Decision

Origin of the case
The data subject filed a complaint after facing difficulties in pursuing his right to object and in relation to the information required on the product order form.

Findings
The LSA found that the delay in complying with the right to object was due to the 72 hours required to process the relevant request, of which the data subject was informed. Besides, the request was submitted on a Saturday and Monday was a holiday. The data controller also took measures to clarify the e-mail address to which such requests can be submitted, and it also set up a dedicated email address to handle such requests more efficiently. In addition, the data controller no longer requires the date of birth to be provided for an order to be placed. Moreover, the consent to receive promotional offers from the controller and third parties must be explicitly given by checking the respective boxes when ordering a product.

Decision
The LSA did not identify any infringement of the obligations set out in Regulation (EU) 2016/679 (GDPR) by the controller. The data controller did not delay to comply with the request beyond what was reasonable and adjusted the information required to avoid collecting more data than necessary.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/publishable_fr_2019-03_lawfulness_summarypublic.pdf

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_de_berlin_2019-04_rightoerasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprimand to controller

Background information
Date of final decision: 3 December 2018
LSA: DE – Berlin
CSAs: BE, DE-Mecklenburg-Western Pomerania
Controller: Chal-Tec GmbH
Legal Reference: Right to erasure (Article 17), Lawfulness of processing (Article 6), Transparent information, communication and modalities for the exercise of the rights of the data subject (Article 12)

Decision: Reprimand
Key words: Right to erasure, exercise of the rights of the data subject, lawfulness of the processing, e-Commerce

Summary of the Decision
Origin of the case
The complainant created an account on the controller’s website, and the same day he asked for its deletion. Despite receiving a confirmation e-mail about the deletion, the complainant could still log in to his account. In an e-mail, the data controller told the complainant that for legal reasons the account could not be deleted, but only deactivated.

Findings
Following a request for information by the LSA, the data controller deleted the account. The improper handling of the data subject’s request was due to keeping two separate databases, each handled by a different department of the controller which had miscommunicated in this case.

Decision
The LSA decided to reprimand the data controller as the removal of the complainant’s personal data was not carried out by the time it was due, i.e. per art. 58(2)(b) GDPR.

Comments
Even though the request was submitted by the complainant prior to the entry into force of the GDPR, on 25 May 2018 the account had not been deleted yet and therefore, the LSA states that the GDPR is applicable.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

publishable_cy_2019-06_righttoerasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

No violation

Background information
Date of final decision: 13 June 2019
LSA: CY
CSAs: AT, DE-Hessen, DK, ES, FR, NL, NO, SK, SE
Controller: IQ OPTION EUROPE LTD
Legal Reference: Right to Erasure (Article 17)
Decision: No violation
Key words: Right to erasure, e-commerce, Exercise of the rights of data subjects

Summary of the Decision
Origin of the case
The complainant alleged that he was denied erasure of his data due to his earlier consent to the general terms and conditions. The general terms and conditions, however, do not elaborate on the data subjects’ rights but only refer in a general manner to the GDPR.

Findings
After seeking information from the data controller, the LSA found that the controller was regulated by AML national legislation, which requires the retention of data for at least five years to ensure that regulators, companies, and customers have access to key business records regarding financial transactions.

Decision
No violation as the processing was lawful under the provision Art 17(1)(b) GDPR providing that “the processing is necessary for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

Please see also EDPB Copyright page

June 28, 2020June 29, 2020

de_berlin_2019-08_righttoobjectandrighttoerasure_summarypublic.pdf

Summary Final Decision Art 60
Complaint

Reprimand to controller

Background information
Date of final decision: 12 September 2018
LSA: DE – Berlin
CSAs: AT, DE – Bavaria (priv), DE – Mecklenburg-Western Pomerania, DE – Saarland, DE – Hesse, DE – Lower Saxony, DK, ES, FR, SE

Controller: Just Fabulous GmbH
Legal Reference: Right to erasure (Art 17)

Decision: Reprimand to Controller
Key words: Right to Erasure, e-commerce, Data Subject Rights not respected, Reprimand

Summary of the DecisionRight to Erasure, e-commerce, Data Subject Rights not respected, Reprimand

Origin of the case
Complainant requested deletion of personal data to the controller on 11 January 2018 and received a confirmation of the deletion on 15 January 2018. Despite this, s/he received e-mails on the 1 June (“Updating our data protection guidelines”) and 16 June 2018 (“Your feedback is important to us”) from the controller.

Findings
The controller did not fulfil its obligation under Article 17 para. 1 letter a GDPR. Controller showed understanding and announced that it would comply with GDPR and put an end to the reprimanded conduct.

Decision
Considering the specific circumstances a reprimand was considered appropriate.

—
This text has been converted automatically from the PDF available via
https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en
using Apache Tika to allow for a better search. This might result in some characters being mangled.
Please see the original file for the official wording at
https://edpb.europa.eu/sites/edpb/files/article-60-final-decisions/summary/de_berlin_2019-08_righttoobjectandrighttoerasure_summarypublic.pdf